Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.require-sri-for has been removed from Firefox (previously only available behind a flag), and was never implemented in Chrome, so has been removed from the spec.
https://github.com/w3c/webappsec-csp/pull/417
https://github.com/w3c/webappsec-subresource-integrity/pull/82
https://bugzilla.mozilla.org/show_bug.cgi?id=1386214
https://bugs.chromium.org/p/chromium/issues/detail?id=618924#c11
Comments
Comment #2
gappleComment #4
gappleThe directive is still defined in
\Drupal\csp\Csp, so that existing uses don't start throwing validation exceptions, but the fields on the administration form and the configuration schema have been removed.